Gemini 4 Carbon opens to all: Google's most powerful model hunts security flaws

What's going on

Google DeepMind made Gemini 4 Carbon generally available on November 10, 2026, calling it its most powerful model yet. Carbon was first unveiled on October 28, about two weeks earlier. Back then, only select security teams got access through the Fairwind Program. According to Diario TI (cited by ecosistemastartup.com), the program has more than 650 partners and prioritizes governments, national cybersecurity agencies, critical infrastructure operators and major tech platforms.

Now the model is widely available:

• Developers: via the paid Gemini API in Google AI Studio and Android Studio. Ultra subscribers can also try it in Google Antigravity, Google's platform for agentic software development.
• Businesses: via Gemini for business (API or model picker), Antigravity and CodeMender.
• Consumers: in the Gemini app and AI Mode in Google Search, but only with a Google AI Ultra subscription.
• Researchers: they can apply for six months of free access to Argon and Carbon in Antigravity.
• Cyber defenders: the specialized "Carbon for cyber" variant remains available through Fairwind.

Carbon isn't meant to replace its predecessor Gemini 4 Argon but to complement it. Google says Argon remains the right choice for most coding and office tasks. Carbon is for the really tough cases: complex multi-step debugging, large software refactors and open scientific questions. To get there, it deliberately uses more tokens (the chunks of text AI models bill by), thinks more thoroughly and checks its own results in longer loops.

What Carbon is supposed to do

Google's main focus is long-horizon agentic workflows – processes where the AI plans on its own, uses tools, checks results and iterates, rather than just answering a question. According to pulse2.com (cited by ecosistemastartup.com), internal teams watched the model work for days on multi-step engineering tasks, finding and fixing subtle bugs in large codebases and low-level systems.

For coding, Carbon is supposed to build web apps in build-and-test loops. It recovers from errors and checks not just the code but also the interface that actually renders. Better visual design and spatial reasoning should also help with 3D games and creative coding. For legal, finance and business workflows, Google promises Carbon can analyze large volumes of dense documents with charts, blueprints and tables, and turn them into precisely formatted spreadsheets, presentations and reports.

New in Google Antigravity is /swarm, for now as a preview. It turns a single request into a coordinated team of agents you can follow in real time. Carbon takes the demanding roles like architecture, coordination and review, while faster, smaller models work in parallel in isolated workspaces. On top of that come "adversarial reviewers" – agents whose job is to deliberately attack every change and test it for bugs.

Finding vulnerabilities in hours, not weeks

Cybersecurity is where Google sees its biggest lead. According to the presentation by DeepMind executive Koray Kavukcuoglu cited by The Hacker News, Carbon achieves these scores:

According to TechRepublic and the blog note.com, Google says it measured these scores without active safeguards. In everyday use with safety filters, results may differ.

Google also cites real-world examples. In Project Fortify, Google's autonomous system for scanning, triaging and fixing vulnerabilities, Carbon hit 100% recall on scanning and 95% precision on triage in an internal test. On open-source repositories, it found over 25% more issues than Argon in relative terms. Google's Cloud Vulnerability Research team used Carbon to prove that two bugs in widely used open-source software are actually exploitable, comparable in severity to the recent PHP2Shell exploit. Details are to follow after responsible disclosure. At security firm Wiz, the model found zero-day vulnerabilities – previously unknown flaws with no patch yet – at two major SaaS providers in under two hours. According to pulse2.com, the Chrome team reports that Carbon delivers more than ten times as many high-quality patches as an unnamed frontier model from another lab.

These capabilities can be abused, too, which is why Google gave the model to defenders first. TechRepublic notes that, according to researchers, AI agents helped compromise 440 PaperCut servers in September. Google also took part in the US government's voluntary pre-release testing program, which TechRepublic points out doesn't amount to government approval.

Research: from Signal proofs to protein folding

Google researchers have used Carbon in several scientific projects:

• Formal verification: the mathematical proof that code does exactly what it's supposed to. Using the new agent framework AlphaProof Code, Carbon generated millions of lines in the proof language Lean. That made it possible to prove key security properties of the real code behind Signal's encryption protocol in weeks. Google says expert teams would normally need years.
• Lab work: from lab notebooks and raw data, Carbon spotted subtle measurement errors, such as incomplete automated mixing in sample tubes. That made enzyme assays much more reproducible.
• Protein structures: for seven hard-to-analyze protein families from the CASP17 blind test, Carbon found on average 40 times as many related sequences (homologs) as before. That gives structure prediction models like AlphaFold 3 more information to work with. Google says broader testing is still underway.

According to Google, Axiom Bio, a company researching drug toxicity, is already using Carbon in production.

Benchmarks and pricing compared

On the independent Artificial Analysis Intelligence Index v5.0, a composite score across nine tests, Carbon led at launch with 59 points, followed by Claude Opus 5.5 (58), GPT-6 Astra (57) and GPT-6.1 Sol (55). But the lead was narrow and didn't last. According to OfficeChai, Anthropic's Claude Fable 5.2 has since overtaken Carbon by 5 points. TechRepublic also points out that Carbon doesn't lead in every category. On OSWorld (computer use), Opus 5.5 scores 87.2% versus Carbon's 81.5%. On FrontierSWE 2, GPT-6 Astra (65.5%) and Opus 5.5 (62.3%) beat Carbon (61.2%). In WebDev Arena, Carbon ranks 4th with 1,768 Elo points, according to pulse2.com. On the new multimodal agent benchmark MKA, which Google developed with Artificial Analysis, Carbon comes second – but, Google says, at more than six times lower cost per task than the leader.

There's one warning sign on knowledge questions. On the AA-Omniscience test, Carbon gets 58% right (Argon: 48%). But the hallucination rate – how often the model confidently makes something up instead of admitting it doesn't know – rises from 4% to 11%. That rate only refers to questions not answered correctly, so it doesn't mean one in nine answers is wrong.

On pricing:

Inputs served from the cache – stored, recurring inputs like an identical system prompt – are 95% cheaper. Google hasn't said when the introductory price ends. According to Infobae, Argon's ends in late November 2026. Even before launch, OfficeChai had spotted 90 price entries for Carbon in Google Cloud's billing catalog, listing the standard $4/$20 price alongside cheaper batch and flex tiers at $2/$10.

Safety and honesty

Google reports stronger safeguards than Argon. In simulated attack scenarios, Carbon blocked 99% of attempts by an adaptive red-teaming agent – an AI that deliberately tries attacks and adapts its strategy after each defense. A breakthrough succeeded in only 0.8% of attempts (Argon: 3.1%). In tests by Gray Swan, the success rate of automated cyberattack requests dropped from 9.86% to 2.17%. Trajectory Labs found no new universal jailbreak in 132 hours and over 13,000 requests. Against indirect prompt injection, where hidden instructions in websites or documents try to hijack the AI, Carbon reached 0% attack success on the Gray Swan benchmark. Google itself admits, however, that sophisticated attacks remain a problem. In an honesty test with 375 agentic tasks, Carbon passed 92% (Argon: 70%) and refused to fabricate missing experimental data in 98% of cases.

The bigger picture

Carbon shows where frontier models are heading: away from quick chat replies and toward hours or days of autonomous work, billed by completed tasks. For developers, price is what matters most. At the introductory rate, Carbon costs only half as much as Claude Opus 5.5. But because it uses more tokens per task, it really pays off for genuinely hard cases. For routine tasks, Google itself recommends Argon. If you're planning long term, budget for the doubled standard price.

Caution is still warranted. Many of the numbers come from Google itself or its partners. At launch, Diario TI criticized the lack of a public methodology for the alignment and honesty figures. Google now points to a Model Card and a safety report. The higher hallucination rate and the top spot already lost to Anthropic, according to OfficeChai, show how tight the race is. Mashable notes that even Anthropic considers small benchmark gaps an increasingly unreliable yardstick. And it remains a sensitive issue that a model capable of finding zero-days in hours would be just as valuable to attackers. Whether Google's safeguards hold up in widespread use remains to be seen.